Add generation-bound retrieval projections

.gitignore

@@ -39,6 +39,7 @@ docs/assets/*
 !docs/concepts/
 docs/concepts/*
 !docs/concepts/canonical-store.md
+!docs/concepts/generation-bound-retrieval.md
 !docs/contributing/
 docs/contributing/*
 !docs/contributing/adapter-contributor.md

README.md

@@ -297,7 +297,7 @@ requests:
 | --- | --- | --- |
 | Records | SQLite | Firestore, AlloyDB/pgvector, Azure Cosmos DB, DynamoDB |
 | Objects | Filesystem | Google Cloud Storage, Cloudflare R2, Azure Blob Storage, S3 |
-| Retrieval | SQLite/local providers | pgvector and provider-shaped adapters |
+| Retrieval | SQLite/local providers | pgvector, OpenSearch, and Cloudflare Worker/R2 projections |
 | Traces | SQLite | Firestore and deployment-specific sinks |
 
 Exercise the portable data boundary without cloud credentials:
@@ -316,6 +316,13 @@ The deterministic local embedding provider is for mechanics and repeatability,
 not semantic quality. ONNX and provider-backed models require explicit model or
 credential configuration.
 
+For derived indexes that need stronger evidence, the optional
+[generation-bound retrieval contract](docs/concepts/generation-bound-retrieval.md)
+pins every result and continuation to one immutable descriptor and fails closed
+unless all requested logical partitions are covered. Local, OpenSearch, and
+Cloudflare Worker/R2 implementations share the candidate-only boundary;
+applications still authorize and hydrate canonical records before use.
+
 RAG ingestion separates planning from commit, persists manifests, and admits
 large mutations through durable execution. RAG context responses preserve
 citations, source spans, truncation diagnostics, and stable context hashes.
@@ -406,6 +413,7 @@ Start with the [execution design](design/execution-runtime.md),
 | Google execution | Live qualified; other Google adapters retain their separate qualification posture |
 | Temporal coordinator and projection | Prototype; disposable and operator-provisioned qualification gates |
 | Cloudflare R2 | Preview object-store adapter |
+| Generation-bound retrieval projections | Local reference plus OpenSearch and Worker/R2 shapes; maturity is topology- and evidence-scoped |
 
 An adapter is `live_qualified` only when the versioned
 [qualification matrix](qualification/README.md) records the required evidence.
@@ -423,6 +431,7 @@ runtimes/      Peer runtime implementations, currently Python
 contracts/     OpenAPI-derived public SDK catalog and JSON schemas
 conformance/   Language-neutral cross-runtime fixtures
 examples/      Short HTTP client recipes
+experiments/   Consumer-neutral provider proofs that are not published packages
 samples/       Runnable .NET and execution examples
 tests/         Unit, integration, conformance, and adapter suites
 qualification/ Versioned adapter qualification report and policy

conformance/runtime/v1/manifest.json

@@ -13,6 +13,7 @@
     "vyral.runtime.external-worker.v1",
     "vyral.runtime.providers.v1",
     "vyral.runtime.canonical.v1",
+    "vyral.runtime.retrieval-generation.v1",
     "vyral.runtime.execution.local.v1",
     "vyral.runtime.rest.v1",
     "vyral.runtime.mcp.stateless-2026-07-28.v1",
@@ -54,6 +55,20 @@
       "profile": "vyral.runtime.data-rag.v1",
       "kind": "golden"
     },
+    {
+      "id": "records.projection-generation.v1",
+      "path": "scenarios/goldens/record-search-projection-generation.json",
+      "sha256": "sha256:98e7a37d649b8008d29118a8cfe51c1ca3a178e58c3a602145717fb26fd8f0ca",
+      "profile": "vyral.runtime.retrieval-generation.v1",
+      "kind": "golden"
+    },
+    {
+      "id": "records.projection-generation-lifecycle.v1",
+      "path": "scenarios/retrieval/generation-bound-lifecycle.json",
+      "sha256": "sha256:7a5433eb745637004155322a76abbb0a5eaf6cf26148b7e18397c1e26c194875",
+      "profile": "vyral.runtime.retrieval-generation.v1",
+      "kind": "stateful"
+    },
     {
       "id": "embeddings.vectors.v1",
       "path": "scenarios/goldens/embedding-vectors.json",

conformance/runtime/v1/scenarios/goldens/record-search-projection-generation.json

@@ -0,0 +1,60 @@
+{
+  "$schema": "../../scenario.schema.json",
+  "id": "records.projection-generation.v1",
+  "fixtureVersion": "1.0.0",
+  "profile": "vyral.runtime.retrieval-generation.v1",
+  "kind": "golden",
+  "description": "Immutable record-search projection descriptor hashing shared by embedded and hosted adapters.",
+  "steps": [
+    {
+      "id": "descriptor-hash-two-partitions",
+      "operation": "records.projection-generation-descriptor-hash",
+      "arguments": {
+        "descriptor": {
+          "schema": "vyral.record-search-projection-generation.v1",
+          "collection": "library",
+          "generationId": "gen-2026-08-27-a",
+          "providerId": "local-exhaustive",
+          "profileId": "lexical-exhaustive-v1",
+          "strategyVersion": "exhaustive-token-v1",
+          "sourceManifestDigest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "recordRevisionSetDigest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+          "projectionSchemaDigest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+          "analyzerDigest": "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+          "configurationDigest": "sha256:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+          "expectedItemCount": 3,
+          "expectedPartitions": [
+            "public-a",
+            "public-b"
+          ],
+          "capabilities": [
+            "completeCoverage",
+            "generationPinnedContinuation",
+            "lexical"
+          ],
+          "artifacts": [
+            {
+              "id": "partition-public-a",
+              "kind": "index-part",
+              "contentHash": "sha256:1111111111111111111111111111111111111111111111111111111111111111",
+              "sizeBytes": 128,
+              "mediaType": "application/octet-stream"
+            },
+            {
+              "id": "partition-public-b",
+              "kind": "index-part",
+              "contentHash": "sha256:2222222222222222222222222222222222222222222222222222222222222222",
+              "sizeBytes": 96,
+              "mediaType": "application/octet-stream"
+            }
+          ],
+          "createdAtUtc": "2026-08-27T12:00:00Z",
+          "descriptorDigest": "sha256:3b92c8927a2a93f12d99e64e03d118e29ac57284663943fa257568ae178d31d5"
+        }
+      },
+      "expect": {
+        "value": "sha256:3b92c8927a2a93f12d99e64e03d118e29ac57284663943fa257568ae178d31d5"
+      }
+    }
+  ]
+}